Description

A security vulnerability has been detected in TOTOLINK EX1200L 9.3.5u.6146_B20201023. Affected by this issue is the function setPasswordCfg of the file /cgi-bin/cstecgi.cgi of the component Password Configuration Handler. The manipulation leads to null pointer dereference. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-17T20:16:47.317Z",
  "pubdate": "2026-08-17T20:16:47.317Z",
  "executiveSummary": "A null pointer dereference vulnerability has been identified in the TOTOLINK EX1200L running firmware version 9.3.5u.6146_B20201023. The security flaw specifically resides within the setPasswordCfg function handled by the /cgi-bin/cstecgi.cgi binary component. This vulnerability allows remote attackers to manipulate specific input parameters, leading to an abnormal termination of the targeted process or potential denial of service conditions. The flaw poses a notable risk to device availability, as it can be triggered remotely without complex prerequisites, and public exploits are currently available for malicious actors to leverage against vulnerable deployments.",
  "technicalDetails": "The vulnerability stems from improper handling of user-supplied input within the setPasswordCfg function located in the /cgi-bin/cstecgi.cgi endpoint of the TOTOLINK EX1200L firmware version 9.3.5u.6146_B20201023. When processing requests directed at the Password Configuration Handler, the application fails to adequately validate or sanitize incoming parameters before memory dereferencing operations occur.\nThe attack flow initiates when an unauthenticated or remote attacker sends a maliciously crafted HTTP request targeting the /cgi-bin/cstecgi.cgi URI. Specifically, the payload is structured to interact with the setPasswordCfg routine by omitting or supplying anomalous values for expected configuration parameters. Upon parsing the request, the underlying C/C++ binary attempts to access a memory address referenced by a pointer that has not been properly initialized or has been nullified due to missing input validation checks.\nBecause the application attempts to read or write to a null memory address, a segmentation fault (SIGSEGV) is triggered, resulting in an immediate crash of the cstecgi.cgi process or the associated web server daemon. Depending on the watchdog configuration of the embedded Linux environment, repeated exploitation can lead to a sustained denial of service state, disrupting administrative access and device functionality. The vulnerability is accessible over the network interface exposed by the router, enabling remote exploitation paths."
}